Cyber Essentials for Government Contracts
What UK public sector tenders actually require, which framework needs which certification, and how to certify before your deadline.
Which UK frameworks require Cyber Essentials?
Almost all of them. Here is the current picture, with the Government Commercial Agency RM references where they apply. For the full agreement-by-agreement table, see Cyber Essentials for Government Commercial Agency frameworks.
Management Consultancy Framework Four (RM6309)
Suppliers on the agreement are Cyber Essentials accredited
Consultancy & Professional Services (RM6399)
Successor to MCF4, same Cyber Essentials expectation
Supply Teachers & Education Recruitment (RM6376)
Framework Schedule 9 lists Cyber Essentials as essential
Digital Outcomes & Specialists 7 (RM1043.9)
CE schedule included, CE or CE Plus set at call-off
Learning & Development 2 (RM6303)
Advertised to buyers as Cyber Essentials accredited suppliers
Security – Physical, Technical & Support (RM6257)
Includes the Schedule 9 Cyber Essentials Scheme
Fuel Cards & Associated Services VII (RM6367)
Framework Schedule 9 lists Cyber Essentials as essential
G-Cloud 15
Cyber Essentials required at supplier onboarding
Technology Services 4
Cyber Essentials required, CE Plus for higher lots
MoD / DCPP
Cyber Essentials baseline; CE Plus for sensitive contracts
NHS SBS
Cyber Essentials required for most clinical and data contracts
Local Authority frameworks
Cyber Essentials standard requirement
Cyber Essentials or Cyber Essentials Plus?
Most tenders need Cyber Essentials (self-assessment, reviewed and issued by an IASME-licensed Certification Body). Cyber Essentials Plus – which adds a hands-on technical audit – is required for:
- MoD contracts handling OFFICIAL-SENSITIVE data
- NHS clinical systems and patient data processing
- Higher-value G-Cloud Lot 2 / Lot 3 engagements
- Contracts where the procurement document explicitly says so
Always read the security schedule of the tender carefully. If unsure, we will tell you for free.
Tender deadline this week?
Our 24-hour fast-track is built for procurement deadlines. We assess your readiness on a 30-minute call and tell you immediately whether we can certify you in time. Same IASME-aligned price as standard.
What about subcontractors?
Prime contractors are usually required to flow Cyber Essentials down the supply chain. If you are bidding as a subcontractor, you will likely need your own certificate – and the prime will ask for evidence before they include you in the bid.